The human factor: why perfect code does not save the crypto industry from billion-dollar losses
July 2026 became a landmark month for understanding real threats in Web3. The code of BonkDAO — the governance structure of the Solana-based memecoin — worked perfectly, without a single error. And yet, about $20 million left the organization's treasury. This was not a hack in the classic sense: the vote was legitimate from the protocol's perspective.
We are witnessing an alarming trend: attacks on governance mechanisms are becoming commonplace, and the main attack vector is increasingly not code, but humans. The irony is that old smart contracts are becoming easy prey for AI, which now serves both as a defense tool and as a universal skeleton key for attackers.
Seizing Decentralization: The BonkDAO Lesson
On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. The attacker did not hack the code — they exploited the DAO's architectural weaknesses and community apathy. Disguised as a routine proposal, Bonk Improvement Proposal #76 on participant rewards, a malicious fund transfer function was embedded within it.
To reach quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total supply. Against a backdrop of low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the transaction executed automatically. The system had no execution delay, the quorum was too low, and the team had no veto power.
This is not an isolated incident. A year earlier, a similar attempt was made against the Compound protocol's DAO, where attackers tried to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only through negotiations after the proposal had already passed. The problem is obvious: low turnout and token concentration are not bugs in the code, but fundamental flaws in Web3 decentralization models. Vitalik Buterin warned as early as the beginning of 2026 that token-oriented governance is vulnerable to capture and ineffective.
Audit as Fiction: 90% of Hacked Contracts Were Audited
While DAOs suffer from the "human factor," the situation with code is different. According to analysts at Kerberus, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not look for complex zero-day vulnerabilities but used long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.
Cross-chain bridges are particularly vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-network messaging creates a huge attack surface, where a single error in one component is enough. Notable examples from 2026: the Truebit hack of $26.4 million due to an integer overflow in an old contract, the attack on the IoTeX bridge through control of a validator's private key, and the year's largest exploit — the theft of $292 million from Kelp through a single LayerZero validator.
AI Strikes: A Prompt Instead of an Auditor
A new adversary for information security specialists is artificial intelligence. In December 2025, Anthropic announced that their AI models had found new exploits worth $4.6 million. During tests on the SCONE-bench benchmark, which included 405 real hacked contracts, neural networks successfully attacked 207 of them, "withdrawing" $550.1 million. Chainalysis analysts are already recording multiple synchronous hacking attempts on different contracts, indicating automated vulnerability enumeration that is beyond human capability.
The Key Matters More Than the Contract
However, no audit would have saved against the largest thefts of recent years. According to Chainalysis, private key theft is the cause of about 40% of all stolen funds. The $1.46 billion Bybit hack in February 2025 is a prime example: signers in the Safe interface approved a substituted transaction. Similarly, in June 2026, Humanity Protocol lost $31 million due to keys stored on a developer's infected computer.
The industry is responding by shifting focus from one-time checks to dynamic monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The effectiveness of this approach was proven by the Venus Protocol incident in September 2025, when an automatic pause triggered 20 minutes before the attack saved funds.
Web3 architecture was created to eliminate trust in humans, transferring control to mathematics. But the statistics of recent years show the opposite: perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms, but in the fact that there are still humans at both ends of the wire.
My conclusion: we are on the verge of a security paradigm shift. The bet on "infallible code" has failed. The future belongs to hybrid systems where mathematical execution guarantees are combined with social recovery mechanisms and active monitoring of behavior, not just contract state.